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What is claimed is: 

1 . A network comprising: 

a set of elements interconnected by services; 

at least one first subset of said elements defining a private network; 

at least one second subset of elements different from said first subset defining 

a provider network wherein at least two subgroups of said first subset of 

elements may be connected via said provider network; 
a services hierarchy wherein virtual private networks are defined on said 

second subset of elements; 
said services hierarchy comprising a father virtual private network and at least 

one affiliated son virtual private network; 
each son virtual private network having at most one affiliated father virtual 

private network; 

each father virtual private network responsible for associating services and 
responsible for associating connections for said at least one affiliated son 
virtual private network; and 

said provider network having a means for associating elements comprising 
said father virtual private network. 

2. A network as claimed in claim 1 wherein each said at least one affiliated son 
virtual private network may recursively act as a father virtual private network 
for a further virtual private network affiliated as a respective son. 
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3. A network as claimed in claim 1 wherein said means for associating elements 
comprising said father virtual private network includes a virtual private network 
descriptor for each father and each son virtual private network. 

4. A network as claimed in claim 3 wherein said virtual private network descriptor 
contains ana ssociation between a n address of each element of said father 
virtual private network and an address of an element of said provider network 
for each case wherein said networks have direct port connections. 

5. A network as claimed in claim 4 wherein said virtual private network descriptor 
for each father and each son virtual private network are grouped into a set of 
virtual private network descriptors arranged in a hierarchy, said hierarchy 
corresponding to a hierarchy defined by said father and said son virtual private 
networks' affiliations. 

6. A network as claimed in claim 5 wherein said means for associating elements 
further comprises a globally unique identifier associated with said father or 
said son virtual private network. 

7. A network as claimed in claim 6 wherein said means for associating elements 
further comprises a set associating for each said globally unique identifier a 
corresponding virtual private network descriptor and an indicator of a level 
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within said hierarchy defined by said father and said son virtual private 
networks' affiliations. 

8. A method of organizing a network having a set of elements interconnected by 
services, wherein at least one first subset of said elements defines a private 
network and at least one second subset of elements different from said first 
subset defines a provider network and wherein at least two subgroups of said 
first subset of elements may be connected via said provider network, said 
method comprising: 

establishing a services hierarchy wherein virtual private networks are defined 

on said second subset of elements; 
establishing within said services hierarchy a father virtual private network and 

at least one affiliated son virtual private network wherein each son virtual 

private network has at most one affiliated father virtual private network; 
establishing each father virtual private network as responsible for associating 

services and responsible for associating connections for said at least one 

affiliated son virtual private network; and 
providing a function for provider network associating elements comprising said 

father virtual private network. 

9. A method as claimed in claim 8 comprising the additional step wherein each 
said at least one affiliated son virtual private network has an option of 
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recursively establishing itself as a father virtual private network for a further 
virtual private network affiliated as a respective son. 

10. A method as claimed in claim 8 wherein said function includes a virtual private 
network descriptor for each father and each son virtual private network. 

11. A method as claimed in claim 10 wherein said virtual private network 
descriptor contains an association between an address of each element of 
said father virtual private network and an address of an element of said 
provider network for each case wherein said networks have direct port 
connections. 

12. A method as claimed in claim 11 wherein said virtual private network 
descriptor for each father and each son virtual private network are grouped 
into a set of virtual private network descriptors arranged in a hierarchy, said 
hierarchy corresponding to a hierarchy defined by said father and said son 
virtual private networks' affiliations. 
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A method as claimed in claim 1 2 wherein said function further comprises a 
globally unique identifier associated with said father or said son virtual private 
network. 
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14. A method as claimed in claim 13 wherein said function further comprises a set 
associating for each said globally unique identifier a corresponding virtual 
private network descriptor and an indicator of a level within said hierarchy 
defined by said father and said son virtual private networks' affiliations. 

15. A method as claimed in claim 14 wherein said set is established by a process 
of auto-discovery. 

16. A method as claimed in claim 15 wherein said process of auto-discovery uses 
Border Gateway Protocol. 

17. An element of a provider network according to the network of claim 1 . 

18. An element of a private network according to the network of claim 1 . 



